I've implemented a Lync Server with a few hiccups along the way, but all services are running now.  When I login to the control panel to add users, for anyone in the Administrators group, I'm getting the following eerror when I try to enable them.

Active Directory operations failed on "my.server.com".  You cannot retry this operation: "Insufficient access rights to perform the operation 00002098: SecErr: DSID-03150E8A, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0"

I've tried giving Administrator rights to the user CSAdministrator and RTCUniversalSystemAdmins, but still get the same result.

The problem is a known and common issue with Domain Administrators or Enterprise Administrators.  It is the recommendation that a user have a elevated priviledge account that they use only when necessary and an everyday use account.  But you can still get this to work with an account that is a domain admin:

If you turn Advanced Features on in AD Users and Computers, locate the user that is a domain admin, select the security tab, click advanced and select "Include Inheritable Permissions from this object's parent" on the user object you then be able to add them for Lync.

Check this out for an explaination of the issue: http://msexchangeteam.com/archive/2009/09/23/452595.aspx

While the link I have provided you is for ActiveSync and Exchange Server 2010, the same resolution applies

Mark

Also, I just posted a new blog about this issue here:

http://www.unplugthepbx.com/Lists/Posts/Post.aspx?ID=31

Mark

• Proposed as answer by AndyK47 Sunday, August 18, 2013 6:22 PM

The problem is a known and common issue with Domain Administrators or Enterprise Administrators.  It is the recommendation that a user have a elevated priviledge account that they use only when necessary and an everyday use account.  But you can still get this to work with an account that is a domain admin:

If you turn Advanced Features on in AD Users and Computers, locate the user that is a domain admin, select the security tab, click advanced and select "Include Inheritable Permissions from this object's parent" on the user object you then be able to add them for Lync.

Check this out for an explaination of the issue: http://msexchangeteam.com/archive/2009/09/23/452595.aspx

While the link I have provided you is for ActiveSync and Exchange Server 2010, the same resolution applies

We figured out our situation and it was indeed the dreaded AdminSDHolder value.  Accounts that did not have elevated rights had this value because at some point in time (before people got smart and started creating separate accounts) those accounts had elevated rights for some reason.  Until that is fixed they will be more difficult to administer.

• Proposed as answer by sham4n Monday, May 21, 2012 6:30 AM

• Proposed as answer by Raul12 Sunday, January 08, 2012 7:08 PM

http://www.unplugthepbx.com/Lists/Posts/Post.aspx?ID=31

do i need to do it for each and every user? can i crerate a group and add the users in that group and allow them with inheting the permission. By doing it , would it impact any permission changes on the AD file level permissions etc.

thanks in advance.

I also have described error. I can move(edit users via power shell, but that is not ok, because our administrators want to configure users via gui. That's why I  have to fix this error. I am getting error on all users (all users are members of different groups, but not domain or enterprise admins). For example, they are members of DOmain users or print operators-builtin groups.

I created dummy user, which is not member of any group. In that case, editing is working. But that is not a solution, because our users have to be in groups.

Attached is error I am getting when I try to edit user (which is not member os domain or enterprise admin).

Any idea how to solve problem will be appreciated.

Regards

Hello,

I have tried all that is suggested previously but nothing works for me. Is there another solution to this? I'm running my Lync Server on a Hyper-V guest and have install and uninstalled several times but still no luck. Can someone assist me? I am in dire need of help and is just banging my head in the wall with no solution.

Thank You

Same issue here.  It happens to me with users that are not domain admins

'

Hi,

i also have this problem but a bit different like when i apply the settings and try it works only one time; and if i try to add another(2nd/3rd etc) user then it doesn't works. Any help will be grateful.

Thanks

Ashraf,

For Domain admins & enterprise admins "Include Inheritable Permissions" permissions reverts back to the original setting after some time..So you need to again enable "Include Inheritable Permissions" tab for Domain Administrators or Enterprise Administrators for lync.

http://www.mytricks.in/2011/08/microsoft-lync-2010-insufficient-access.html

Thank you! it work for me!

Regards!